Skip to main content

Improper Control of Dynamically-Managed Code Resources

CVE-2022-36067

High
10/10

Summary

The package vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to 3.9.11, a threat actor can bypass the sandbox protections to gain Remote Code Execution rights on the host running the sandbox. There are no known workarounds.

  • LOW
  • NETWORK
  • HIGH
  • CHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-913 - Improper Control of Dynamically-Managed Code Resources

The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

References

Advisory Timeline

  • Published